View source for OWTF Botnet mode

From BruCON 2016

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

You can view and copy the source of this page.

OWASP OWTF is the Offensive (Web) Testing Framework, a project designed to facilitate penetration testing, making security assessments as efficient as possible. Please see: http://owtf.org for more information.

This presentation will cover the following OWASP OWTF projects:

1) Botnet Mode:
A Brucon 5x5 project designed to make OWTF emulate a botnet, this makes it easier for the average penetration tester to test a website using multiple IP addresses (i.e. like real-world attackers having a botnet can), even when OWTF is launched from a single IP address.

This makes it practical to test if security controls can be bypassed when the origin IP of the scanning machine changes.

2) WAF Bypasser:
While multiple WAF bypassing tools exist, few of them focus on bypassing poorly written virtual patches, indeed, there are many possible mistakes that can occur when web application code handles HTTP requests vs, what the WAF is looking at. This nifty project can additionally be run either standalone or as an OWTF aux plugin. It should be no surprise that the WAF bypasser was found to work well against production WAFs and we even found some cool 0-day during development :)

Return to OWTF Botnet mode.

Retrieved from "http://2016.brucon.org/index.php/OWTF_Botnet_mode"

navigation

SEARCH

TOOLBOX

LANGUAGES

View source for OWTF Botnet mode

From BruCON 2016